Quantum coin tossing and bit-string generation in the presence of noise 
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We discuss the security implications of noise for quantum coin tossing protocols. We find that 
if quantum error correction can be used, so that noise levels can be made arbitrarily small, then 
reasonable security conditions for coin tossing can be framed so that results from the noiseless case 
will continue to hold. If, however, error correction is not available (as is the case with present day 
technology), and significant noise is present, then tossing a single coin becomes problematic. In 
this case, we are led to consider random n-bit string generation in the presence of noise, rather 
than single-shot coin tossing. We introduce precise security criteria for n-bit string generation and 
describe an explicit protocol that could be implemented with present day technology. In general, a 
cheater can exploit noise in order to bias coins to their advantage. We derive explicit upper bounds 
on the average bias achievable by a cheater for given noise levels. 

PACS numbers: 03.67.Dd, 03.67.Pp, 05.40.Ca 



The cryptographic task of coin tossing was first intro- 
duced by Blum lj. Briefly, the idea is that two sepa- 
rated, mistrustful parties wish to generate a random bit 
and be sure that the other party cannot have biased the 
bit by more than a certain amount. Secure coin tossing is 
known to be impossible classically, unless either compu- 
tational assumptions or special relativistic considerations 
are invoked. Upon using a quantum communication 
channel, however, it is possible to achieve levels of secu- 
rity that are impossible classically. Various results con- 
cerning the security of quantum coin tossing under dif- 
ferent assumptions, and its relationship to other crypto- 
graphic tasks (in particular ^bit commitment ), h ave been 

obtained HH SI! USE EES EJ E 13 111 Ei 

It would be highly desirable to implement quantum 
coin tossing experimentally. Long distance quantum 
communication is indeed possible with present technol- 
ogy ^3 1 an d it may be possible to adapt such techniques 
to coin tossing. In real life situations, however, state 
preparation, communication channels and measurements 
are all imperfect, while all the above results refer to the 
ideal situation where no noise is present. As the example 
of quantum key distribution illustrates, a large amount of 
theoretical work must be carried out before an idealized 
quantum communication protocol can be implemented 
experimentally with the effect of all experimental imper- 
fections taken into account. The present work initiates 
this line of investigation in the case of quantum coin toss- 
ing. 

In particular, we shall argue that if quantum error cor- 
rection can be used, then noise can in principle be made 
arbitrarily small, and one can frame security definitions 
such that results holding in the noiseless case still apply. 
On the other hand, if techniques such as quantum error 
correction are not available (as is the case with present 
day technology), then there will be a significant level of 



noise that cannot be reduced. In this case, tossing a sin- 
gle coin is problematic, in the sense that it is not possible 
to frame sensible security conditions that can actually be 
satisfied. But tossing a string of coins such that the av- 
erage bias is bounded is possible. We obtain detailed 
results concerning the relation between the amount of 
noise and this average bias. 

We begin with some definitions that have been intro- 
duced for noiseless coin tossing (see, e.g., Ref. gj). A coin 
tossing protocol involves a sequence of rounds of commu- 
nication, at the end of which either a bit x is produced, 
whose value is agreed on by both parties, or one party 
or the other aborts, in which case we write symbolically 
x = oo. We denote by Pt Sa ' Sb (x — c) the probability 
that x = c, assuming that Alice follows a strategy Sa 
and Bob Sb- We denote Alice's honest strategy (i.e., 
that defined by the protocol) as Ha and Bob's as Hb- A 
protocol is correct if, for c = 0, 1 
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h a ,h b , _ v _ 



(x = c) = 1/2. 



Security conditions are written as 

VS A Pt Sa ' Hb (x = 0) < 1/2 + e A 

VS a Pi Sa ' Hb {x = 1) < 1/2 + e A 

VS B Pr HA ' SB {x = Q) < 1/2 + e B 

VS B Pi HaSb (x = 1) < 1/2 + e s . 



(1) 



(2) 
(3) 
(4) 
(5) 



(These conditions define the task known as strong coin 
tossing. A weaker task can be defined by imposing only 
(|2")l and This is known as weak coin tossing. In 

this work we are concerned only with strong coin toss- 
ing. With this understood, we shall simply call it coin 
tossing.) A protocol is perfectly secure iff €a = (b = 0. 
A protocol is arbitrarily secure iff €a and es can be 
made arbitrarily small as some parameter associated with 
the protocol increases. A protocol is partially secure iff 
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€a,£b < 1/2. Perfectly secure coin tossing is shown 
to be impossible in Ref. p|. More recently, Kitaev has 
shown [lJj that for any possible protocol, either or 
€b > l/v2— 1/2. This result implies that arbitrarily 
secure strong coin tossing is impossible. At present, the 
best protocol for strong coin tossing is due to Ambainis 
and achieves ca — £s = 1/4 (close to Kitaev's lower 
bound). 

In order to discuss what happens when noise is present, 
we first describe a very simple protocol for coin tossing 
in the absence of noise (it is similar to the protocol for 
quantum gambling developed in Ref. 0). The protocol 
is for strong coin tossing and is partially secure. It is not 
as good as that of Ambainis, but is illustrative. We shall 
then consider how it is affected by noise. The protocol is 
as follows. 

i) Alice generates a random bit b € {0, 1}, and prepares 
a quantum state \<j)b), where < |((/)o|</>i)| 2 < 1. We write 
K^ol^i)! 2 = cos 2 #. Alice sends \4>b) to Bob. 

ii) Bob generates a random bit b' and sends it to Alice. 

iii) Alice sends b to Bob. 

iv) Bob measures the quantum state in a basis contain- 
ing |(/)(,) to check that Alice is not cheating. He aborts if 
he gets an outcome different from \4>b)- In this case we 
write the outcome of the coin toss as x = 00. Otherwise, 
the outcome of the coin toss is x = b © b'. 

It is easy to show that Alice's best cheating strategy 
is to send a state \x) such that |(xl0o)| 2 = I(xl0i)| 2 = 
cos 2 6/2, and then to declare b as she requires. (In partic- 
ular, it is never to her advantage to declare the opposite 
value of 6, and this implies that strategies that involve 
her entangling two systems and sending one to Bob can- 
not help.) Bob's best cheating strategy is to measure the 
quantum state as soon as he receives it, in order to de- 
termine as well as possible whether it is |0o) or 

I'M 13- 

We get that for c = 0, 1, 

VS A Pr SAMB (x = c) < 1/2+ (1/2) cos 6 

V S B Pt Ha - Sb (x = c) < 1/2 + (1/2) sin 9. (6) 

Note that the protocol is correct. 

How are this protocol, and the corresponding secu- 
rity considerations, affected if it is assumed that noise 
is present? We discuss mainly the case in which the 
quantum channel separating Alice and Bob is noisy, but 
in which all other devices are perfect. Other types of 
experimental imperfections that could be considered in- 
clude, for example, noise in state preparation and mea- 
surement, or the limited efficiency of detectors. The ar- 
guments we use in the case of noisy channels can easily be 
adapted to these other situations. In general, the channel 
can be described by a linear, completely positive, trace- 
preserving map £ . Thus Bob will receive the noisy state 
p a = £(\ip a ))- For long distance quantum communica- 
tion the principal type of noise will be losses. Losses can 
in principle be included in the form of £ , but it may be 



convenient to consider them separately. An honest party 
must assume that the other, potentially dishonest, party 
can control everything outside the honest party's labora- 
tory. In particular, this means that a cheater can replace 
the noisy channel with a noiseless one, introducing noise 
only as and when he or she wants. 

The presence of noise on the face of it affords several 
simple cheating strategies. We list a few. 

i) If the channel is lossy, and the rules specify that if 
Bob's detector does not fire then he simply has to accept 
whatever value of b Alice declares, then Alice may cheat 
simply by not sending any quantum state at all. Bob 
will think that the state was lost in the channel. Alice 
will declare whatever value of b she wants, winning with 
certainty. 

ii) Suppose alternately that the rules specify that if 
Bob receives no state, he is allowed to declare "no fire," 
and the protocol recommences. Then a cheating Bob 
may replace the noisy, lossy channel with a noiseless one, 
so that the states he must discriminate are pure. He then 
(using a perfect detector) performs a conclusive measure- 
ment on the quantum state, with outcomes "definitely 
\4>o)" "definitely |0i)," and "inconclusive" K the 
"inconclusive" result is obtained, then Bob declares "no 
fire," and the protocol repeats. The protocol will keep 
repeating until a run occurs on which Bob finds out the 
value of b with certainty. He can then obtain the outcome 
he wants with certainty by choosing b' appropriately. 

iii) In general, both po and p\ will have support on the 
entire Hilbert space. This means that a cheating Alice 
can send |</>o) to Bob, and then declare that b = or 
b = 1 as she needs. Even in the event that Alice declares 
6=1, there will be no measurement result of Bob's that 
tells him for certain that Alice is cheating. 

In addition, if the channel is noisy and if a certain out- 
come of Bob's leads him to abort the protocol, then there 
is a nonzero probability that he may obtain this result 
even when Alice is honest. In this case, the protocol is 
no longer correct, because there is a nonzero probability 
that a player aborts, even when both are honest. 

It should be clear that most of these remarks will apply 
in some form or other to any conceivable coin tossing 
protocol. If correctness is redefined as 

Yy Ha ' Hb {x = c) = (1 - 5) /2 
Py HaHb (x = 00) = S, (7) 

for c = 0,1, where S must tend to zero as some parame- 
ter associated with the protocol increases, and if similar 
modifications are made to the security conditions, then 
protocols can still be made (at least partially) secure, as 
long as error correction is available. In this work, how- 
ever, we are interested in the case in which there is no 
technique for making noise arbitrarily small. Protocols 
for tossing a single coin will then either allow one of the 
parties to bias the coin completely, or will abort with un- 
acceptably high probability even though both parties are 
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honest. They are therefore of limited interest. For these 
reasons we consider instead a slightly different scenario, 
in which Alice and Bob want to generate a random n-bit 
string. 

The basic reason why random n-bit string generation 
is easier to implement in the presence of noise is that, 
since the quantum channel is used many times, one can 
test that the average noise level is as expected. This is 
to be contrasted with a single use of the channel, which 
only provides very partial information about the noise 
present. Furthermore the probability that the protocol 
aborts when both parties are honest decreases exponen- 
tially with n. This is due to the fact that the chan- 
nel is used many times, which makes large fluctuations 
about the expected noise highly improbable. On the 
other hand, because the noise is only constrained on av- 
erage, a cheater can determine any bit of the string with 
certainty. This implies that one cannot extract from the 
bit string a single unbiased bit (for instance by taking 
the parity of the bit string) . But the average bias of the 
bits can be bounded [22j |. 

The problem of generating a random n-bit string in 
the absence of noise has previously been considered by 
Kent J14J, who showed that it is not a straightforward 
extension of the problem of generating a single random 
bit. We now introduce some precise security criteria for 
n-bit string generation. The output of a protocol for 
n-bit string generation is x, where either x is an n-bit 
string, or one or the other party aborts, in which case we 
write symbolically x = oo. 

One security condition that one could imagine for n-bit 
string generation is that each bit of the string has small 
bias. This could be expressed as 

VS A Vi Pr SA ' HB (x t = c) < 1/2 + e A , (8) 

for c = 0, 1, along with a similar condition for Bob. Here, 
Xi is the ith bit of x. As we have argued above, this type 
of security is not achievable in the presence of noise. 

A weaker security condition is that on average the bias 
of the bits is small. We express this as 

VS A Vc - Y Pt Sa > Hb ( Xi = a) < 1/2 + e A , (9) 

i 

along with a similar condition for Bob. We have that Xi, 
Ci are the ith bits of x,c, with c an arbitrary n-bit string 
describing a possible result of the coin tosses. 

Other security conditions are possible. Satisfaction of 
condition © or © is compatible with a cheater fixing 
things so that the outcome is either 00 ... with proba- 
bility 1/2 or 11 ... 1, with probability 1/2. It would be 
desirable to have a security condition expressing the fact 
that the entropy of the bit string is large, satisfaction of 
which would rule out such cheating. In the remainder 
of this article, however, we will restrict ourselves to the 
security condition expressed by Eq. In general, e A 



and cb will depend on n. For simplicity we shall only be 
interested in the values of these quantities in the limit of 
large n. 

We define correctness by 

Vc Fv Ha > Hb (x = c) = (l-<5)/2" 

Vi HaHb (x = oo) = 5, (10) 

where 5 must tend to zero as n becomes large. 

We now introduce a protocol for random n-bit string 
generation that is adapted from the simple coin tossing 
protocol above. Then we will consider the security of this 
protocol in the presence of noise. 

1) For i = 1 to n: 

1) Alice generates a random bit bi S {0, 1}, and pre- 
pares a quantum state 10b;), where < | (0o|0i) | 2 < 1. 
Alice sends 10^) to Bob. 

ii) Bob generates a random bit b\ and sends it to Alice. 

iii) Alice sends bi to Bob. 

iv) Bob measures the quantum state in a random basis. 
If his detector fails, this is considered as a null outcome. 

Next i. 

2) Bob uses his measurement statistics to estimate 
po, the average state he received when Alice declared 
bi = 0, and pi, the average state he received when Alice 
declared 6» = 1. If cither of the fidelities, (0o|po|0o) and 
($1 1 Pi I $1 ) j is less than 1 — 7 (where < 7 < 1 is decided 
in advance), then Bob aborts the protocol. Otherwise the 
output of the protocol is an n-bit string with Xi = bi © b\. 

This protocol is essentially the simple protocol above 
repeated n times, with two modifications. First, Bob 
measures each time in a random basis - he is performing 
a sort of state estimation in order that he can bound 
any potential cheating by Alice. Second, an honest Bob 
does not have the option of aborting until the end of 
the protocol when he has collected all his statistics. It is 
easy to see that if the fidelity of the whole process of state 
preparation, transmission and measurement is F > 1 —7, 
then the protocol is correct. 

We investigate available cheating strategies for this 
protocol, assuming that the only noise is noise in the 
quantum channel, described by £, and that either there 
are no losses or they are included in the form of £. We 
can consider two cases. In the first, a cheater's actions 
on different runs (that is, different values of i in the pro- 
tocol above) are uncorrelated. Thus, we simply need to 
consider one strategy, perhaps involving random choices, 
that is repeated for each run. In the second, a cheater's 
actions on different runs may be correlated, and may 
even involve entanglement across the different runs [23| . 
In this paper, we will restrict ourselves to uncorrelated 
cheating. Elsewhere, we show that this protocol in fact 
satisfies an entropic security condition, even when corre- 
lated or entangled attacks are considered [lflj . 

A cheating Bob is easiest to deal with. His best strat- 
egy is to replace the noisy channel with a noiseless one, 
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thus ensuring that the states he receives are |0o) and 
\<pi). He can measure each state as soon as he receives 
it, in order to determine as well as possible the iden- 
tity of the state. He can then choose 6- appropriately. 
As mentioned before, this gives ts — 1/2 sin 6*, where 
|(^o|</>i)| 2 = cos 2 0. 

The most general strategy for a cheating Alice is to 
prepare a pure state \iP)ab, and send the B subsystem 
to Bob via a noiseless channel. (In general, of course, Al- 
ice may prepare an overall mixed state, perhaps resulting 
from a probabilistic mixture of pure states. We lose no 
generality, however, by supposing that Alice prepares a 
pure state, as Alice can always introduce an extra ancilla 
such that \4>)ab is a purification of the mixed state.) We 
denote the reduced density matrix for Bob's subsystem 
by pb- Alice then waits for the bit b\. The value of b\ and 
the outcome of the coin toss that she wants determine to- 
gether the value of hi that Alice wants to declare. If Alice 
wants to declare bi = 0, then she performs a two-outcome 
positive operator-valued (POV) measurement Mo on the 
A subsystem. Denoting the outcomes M 00 and Moi, Al- 
ice declares 6^ = (thus winning) if she obtains Moo and 
bi = 1 (thus losing) if she obtains Moi. If Alice wants 
to declare bi — I, on the other hand, then she performs 
a POV measurement Mi. She declares 6^ = (losing) if 
she obtains Mio and bi — 1 (winning) if she obtains M±±. 

What advantage does this strategy give Alice? Sup- 
pose that Bob's (normalized) reduced density matrices, 
conditioned on Alice getting the outcomes Mao, Moi, 
Mio and M\\, are a, d, f and r respectively. Then we 
can write 



Pb = qcr + (1 ~q)cr, 
PB = q'r+(l- q')f, 



(11) 
(12) 



v-, t , f, then the Hughston-Jozsa-Wootters (HJW) the- 
orem j2Cj ensures that there does indeed exist a strat- 
egy of Alice's that corresponds to this solution. In other 
words, there is a state |-0)ab> and measurements Ma and 
Mi, that give rise to <t, ct, r, f when we condition on Al- 
ice's outcomes. 

We have obtained an upper bound on Alice's cheating 
capacity that applies for arbitrary quantum states and 
noise. We write the fidelity between a general state p 
and a pure state \ip) as F(p, \tp)) = (ip\p\ip). We write 
the trace distance between two general states p and p' 
as D(p,p') = l/2\\p- p'l where ||^|| = TrV^U. All 
the results concerning these quantities used below can 
be found in Ref. [2l| (although note that the fidelity is 
defined slightly differently). 

Theorem 1 For all uncorrelated strategies of Alice, we 
have that for large n, 
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sin 



(17) 



To prove this bound, note that if Bob is not to abort we 
must have F(po, \4>o)) > 1 — 7j and that this, along with 
Eq. lfl3|) . gives 

q (4>o\<r\<M +(!-«) (0o|t|0 o > > 1 - 7- 



This in turn implies 



M°#o) > l - i/q- 



Using the fact that D(p, p') < yT— F(p, p') for arbitrary 
states p and p' , this gives us 



where q is the probability of Alice getting outcome Moo, 
given that she performs measurement Ma, and q' is the 
probability of her getting outcome Mn, given that she 
performs measurement Mi. It can be shown via a sym- 
metry argument that we do not lose generality if we sup- 
pose that 



We can also write 

PB 

Pi) 
Pi 



q = q . 



\ (Po + Pi) 



qa + (1 -q)r, 
q'T + (l-q')a. 



(13) 



(14) 

(15) 
(16) 



The probability of Alice getting the outcome she wants 
is given by q, so we have that = q — 1/2. The prob- 
lem is now to maximize q subject to the constraints 
of Eqs. (|11|I - (|16JI (and of course the constraints that 
< q < 1 and that <r, ti, r, f are valid normalized den- 
sity operators). Note that if we find a solution for valid 



Similarly, we can derive D(t, \<fio)) < y/j/O- — q), 
DiaM) < y/j/il-q), and D(t,|&» < ^J~q. We 
now recall, from Eqs. (f 1 If) - (f 13|) . that 

p B = qa-+ (1 - q)a = qr+ (1 - q)f. 

Combining this with the above, and using the fact that 
D(p,p') = maxp \Tt(Pp) - Tr(Pp')|, where the maxi- 
mum is over all projection operators, we get that 

q(Tr(P ItoXfol) - Vl/q) + (1 - <7)(Tr(m)(0i|) ~ 



^7/(1 - q)) < <z(Tr(P|0i)(0i|) + v /^) + 
(1 - 9 )(Tr(P|^o)(^o|) + ^7/(1 -<?)), 



(18) 



for any projection operator P. Setting P — \4>o)( ( t'o\ then 
gives Theorem ^ 

We have also analyzed in detail the simple case in 
which the quantum states are qubit states and the chan- 
nel is a depolarizing channel, acting as p — ► £ (p) = 
f p + (1 — /) 1/2. In this case, Alice's optimal cheating 
strategy can be found explicitly: 
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Theorem 2 For the qubit depolarizing channel, if Alice 
adopts her optimal uncorrelated cheating strategy, then 
for large n 

e A = 1(1- f sin0) if/</*, 



(A 



'/ 2 (l-/ 2 )cos 2 

i - p cos 2 e 



if / > r 



(19) 



where f* = (a/I + 3 cos 2 - sin 0) /2 cos 2 0. 

The proof of Theorem [2 is given in the appendix. 

We can compare this result with the upper bound 
above. If we set / = 1 — 27, then for fixed 9, we find 
that €a — + \/jcot9, as 7 — > 0. This shows that the 7 
dependence of Eq. Ijl7|l is close to optimal. 

In conclusion, we have shown that the attainable secu- 
rity in quantum coin tossing is qualitatively affected by 
the presence of noise. Indeed in the presence of signifi- 
cant noise, tossing a single coin does not give acceptable 
security. Rather, in this case one should consider pro- 
tocols for generation of strings of random bits. As we 
explain above, generating a string of random bits is a 
weaker protocol than tossing a single coin. However in 
situations where one needs to toss coins many times in 
succession (for instance if one wants to play repeatedly 
with a quantum casino), then bit-string generation can 
be useful. The importance of bit-string generation is that 
even in situations where tossing a single coin is impossi- 
ble, it will be possible to generate a string of bits such 
that the average bias of the bits is bounded. We have 
illustrated this by a simple protocol for which we prove 
bounds on the average bias in the case where uncorre- 
lated cheating strategies are used. 

Our work is motivated by the present status of quan- 
tum communication. Indeed with present day optical 
technology, quantum communication can be performed 
over short distances (e.g., laboratory length scales) with 
minimal noise and absorption. In this case, Theorem ^ 
above indicates that quantum n-bit string generation, us- 
ing our protocol, should be practically possible with good 
security. Over longer distances (kilometers and above), 
losses in particular are significant, and our results would 
need to be generalized. 

We would like to thank Harry Buhrman and Hcin 
Roehrig for useful discussions. We acknowledge financial 
support from the Communaute Franchise de Belgique un- 
der grant ARC 00/05-251, from the IUAP programme of 
the Belgian government under grant V-18, from the EU 
under project RESQ (IST-2001-37559). 

Appendix: Proof of Theorem [2] 

To prove Theorem [21 note that without loss of gener- 
ality we can write 



\(f>o)(M = 1/2 (I + aa z -Pa x ), 
(0! I = 1/2 (I + aa z +Pa x ), 



where a x and a z are Pauli sigma matrices, a 2 + 1 = 1, 
and we have that a — cos 8, (3 = sin0. Recall that the 
channel acts as 

p^£(p) = fp+(l-f)I/2. (21) 

We then begin by writing 

po = 1/2(1 + afa z - /3fa x ), 

p x = 1/2(7 + a fa z + /3fa x ) (22) 

and 



qa = 1/2 (ql + s x a x + s y a y + s z a z ) , 
(l-q)a = 1/2 ((1 - q)I + s x a x + s y a y + s z a z ) , 

qr = 1/2 (ql + t x a x + t y a y +t z a z ) , 
(l-q)f = 1/2 ((1 - q)I + t x a x + lyo-y + t z a z ) , 

(23) 

where —1 < s x ,s y ,s z < 1, and so on. Conditions 111|) - 
(|16H imply 



s z +s z = fa, s x +s x = 0, 

t z +i z = fa, t x +t x = 0, 

s z +i z = fa, s x +i x = -f[3, 

s z +t z = fa, s x + t x = ffi, 



while symmetry considerations imply 



t, 



t, 



0. 



(24) 



(25) 



From the positivity of the matrices a, a, t, t, we then have 
that 



2,2^ 2 
s z + s x < q , 

s z f + sl < (1-qf, 



(fa 

4 + (fP + s x f 

(fa~s z ) 2 + (fP + Sx ) 2 < (1-q) 2 



(26) 



Our aim is to maximize q with respect to s x and s z , 
subject to the various constraints. The HJW theorem 
|2?1 | will ensure that there do exist measurements Mq 
and Mi, such that conditions (|llfl . (|12fl . and l|23|l are 
satisfied. 

By inspection we see that the maximum value of q can 
be obtained when s x = —f (3/2. This leaves 



< <z 2 , 



s 2 z + l/4(/ 2 /? 2 ) 
(/a- S2 ) 2 + l/4(/ 2 /? 2 ) < (l~q) 2 . 



(27) 



(20) 



If we consider the equation derived from each of these 
inequalities, we see that each represents a hyperbola in 
the qs z plane. Geometrical considerations tell us that 
there are two cases to be considered. In the first case, we 
need only find a turning point of the second hyperbola, 
and it is guaranteed to lie above the first hyperbola, so 
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that the first inequality will be satisfied. This occurs if 
f 2 a 2 < 1 — f\(3\ (i.e., / < /*). In this case, it is easy to 
see that we maximize q by setting s z = fa, giving 



q = l-(l/2)(/|/3|), 
e A = (l/2)(l-sin0). 



(28) 



In the second case, the relevant turning point of the sec- 
ond hyperbola lies below the first, implying that this is 
not a solution that satisfies both inequalities. This oc- 
curs if f 2 a 2 > 1 — f\(3\ (i.e., / > /*). In this case, we 
find the maximum q by finding the intersection of the 
two hyperbolae, i.e., by considering both inequalities as 
equalities. A short calculation then gives 



q = 



11 jpa 2 {l-f 2 ) 
2 2 



1 - f 2 a 2 



l/ / 2 (l-/ 2 )cos 2 ( 



1 — p cos 2 



which is achieved when 



1, x 9 1 
2 fa 2fa 



(29) 



(30) 



Throughout, we have ignored solutions corresponding to 
unphysical values of the variables. The explicit forms 
for Alice's measurements Mq and Mi can be calculated 
from the values for the ss and the ts, although we have 
not done this here. 
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